F5 and Confluence Attack Chain Hits Hybrid Identity

Introduction

Microsoft has published a new incident analysis showing how a compromise of an internet-facing edge appliance can quickly turn into a much broader enterprise breach. For security teams, the key lesson is clear: edge devices, Linux servers, internal web apps, and identity systems must all be treated as part of the same attack surface.

What happened

The attack chain began with an F5 BIG-IP Virtual Edition appliance hosted in Azure. Microsoft said the device was running an end-of-life version, making it a likely entry point through exploitation of a known vulnerability.

The threat actor then:

• Used the F5 appliance to gain SSH access to an internal Linux server
• Performed network discovery and reconnaissance with tools including Nmap and gowitness
• Downloaded a custom Linux reconnaissance tool detected as HackTool:Linux/MalPack.B
• Identified an unpatched Atlassian Confluence server and used it for remote code execution
• Extracted credentials from Confluence configuration files
• Attempted NTLM and Kerberos relay-style attacks against Active Directory, including activity tied to CVE-2025-33073

Microsoft noted that the attacker maintained privileged access without deploying formal persistence, relying instead on trusted access and over-privileged accounts.

Why this matters for defenders

This incident shows how modern attacks increasingly cross traditional boundaries:

• Edge appliances are becoming high-value initial access points
• Linux systems are often less monitored than Windows endpoints
• Internal apps like Confluence can expose sensitive service credentials
• Hybrid identity trust relationships can enable lateral movement that bypasses perimeter-focused defenses

Even when a vulnerable application is not internet-facing, attackers can still reach it after compromising another trusted system inside the environment.

Impact on IT administrators

Security and infrastructure teams should review whether they have:

• Unsupported or end-of-life edge appliances still in production
• Over-privileged Linux accounts with broad sudo access
• Unpatched Confluence or other internal web applications
• Monitoring coverage across network devices, Linux hosts, SaaS apps, and identity events

Organizations using Azure-hosted network appliances should also validate image versions used in ARM templates or Terraform deployments.

Recommended next steps

• Patch or replace EOL F5 BIG-IP instances immediately
• Audit and reduce privileged SSH access on Linux systems
• Patch Confluence and review stored application credentials
• Monitor for unusual cross-system authentication activity involving service accounts
• Use Microsoft Defender XDR detections, advanced hunting, and attack path analysis to identify related exposure

The broader takeaway is that defenders should stop viewing edge, endpoint, SaaS, and identity security as separate problems. Attackers are already treating them as one connected path.